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Recently applying artificial intelligence, machine learning and data mining techniques 
to intrusion detection system are increasing. But most of researches are focused on 
improving the performance of classifier. Selecting important features from input ... 
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File-system integrity tools (FIT) are commonly deployed host-based intrusion 
detections (HIDS) tool to detect unauthorized file-system changes. While FIT are 
widely used, this kind of HIDS has many drawbacks: the intrusion detection is not 
done in real-time ... 
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A variety of tools and architectures have been developed to detect security violations 
to Operating System kernels. However, they all have fundamental flaw in the design 
so that they fail to discover kernel-level attack. Few hardware solutions have been ... 
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Detecting attacks against systems has, in practice, largely been delegated to 
sensors, such as network intrustion detection systems. However, due to the inherent 
limitations of these systems and the increasing use of encryption in communication, 
intrusion ... 
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Network intrusion detection systems typically detect worms by examining packet or 
flow logs for known signatures. Not only does this approach mean worms cannot be 
detected until the signatures are created, but that variants of known worms will 
remain ... 


I me vTme C\v\pj;j]Yn Sni Wo^vs ^V«\ o»"*m Pa;j 
Konrad Rieck, Pavel Laskov 

June 2008 The Journal of Machine Learning Research, Volume 9 
Publisher: MIT Press 


Full text available Q 


Additional Information: 


Bibliometrics: Downloads (6 Weeks): 0, Downloads (12 Months): 0, Citation Count: 0 

Efficient and expressive comparison of sequences is an essential procedure for 
learning with sequential data. In this article we propose a generic framework for 
computation of similarity measures for sequences, covering various kernel, distance 
and non-metric ... 
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Masqueraders, despite widespread use of security products such as firewalls and 
intrusion detection systems, are serious threats to organizations. Although anomaly 
detection techniques have been considered as an effective approach to complement 
existing ... 
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This paper describes the implementation of a coprocessor platform for scanning 
workstation memory in order to detect signatures of malicious codes. The 
coprocessor is especially beneficial in clusters of workstations used for high 
performance computing ... 
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As modern operating systems and software become larger and more complex, they 
are more likely to contain bugs, which may allow attackers to gain illegitimate 
access. A fast and reliable mechanism to discern and generate vaccines for such 
attacks is vital ... 


Georgios Portokahdis, Asia Slowmska, Herbert Bos 

April EuroSys '06: Proceedings of the 1st ACM SIGOPS/EuroSys European 
2006 Conference on Computer Systems 2006 
Publisher: ACM 

Full text available: «Qp-iM Additional Information: \ ov\",,'«.i i, ,1 sv^^,>'i'u'. v 1 , 

Bibliometrics: Downloads (6 Weeks): 20, Downloads (12 Months): 164, Citation Count: 5 


http://portal.acm.org/results.cfm?coll=ACM&dl=ACM&CFID=40444123&CFTOKEN=67859397 (4 of 8)8/14/08 3:02:36 PM 


Results (page 1): kernel, intrusion 


As modern operating systems and software become larger and more complex, they 
are more likely to contain bugs, which may allow attackers to gain illegitimate 
access. A fast and reliable mechanism to discern and generate vaccines for such 
attacks is vital ... 
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Increasing demands for reliability and dependability clash with the reality of 
escalating security compromises and vulnerability discoveries. Improvements in 
attack methodologies such as polymorphic viruses, tampering of source code 
repositories, and ... 
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A Feather-weight Virtual Machine (FVM) is an OS-level virtualization technology that 
enables multiple isolated execution environments to exist on a single Windows 
kernel. The key design goal of FVM is efficient resource sharing among VMs so as to 
minimize ... 

Keywords: binary server, browser exploit, information theft, virtual machine, web 
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String searching is the computationally intensive kernel of many security and 
network applications like search engines, intrusion detection systems, virus scanners 
and spam filters. The growing size of on-line content and the increasing wire speeds 
push ... 
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The arrival of any piece of unsolicited and unwanted email (spam) into a user's email 
inbox is a problem. It results in real costs to organisations and possibly an increasing 
reluctance to use email by some users. Currently most spam prevention 
techniques ... 
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Standard SVM training has 0(m 3 ) time and 0(m 2 ) space complexities, where m is 
the training set size. It is thus computationally infeasible on very large data sets. By 
observing that practical SVM ... 
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Recovery from intrusions is typically a very time-consuming operation in current 
systems. At a time when the cost of human resources dominates the cost of 
computing resources, we argue that next generation systems should be built with 
automated intrusion ... 
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Recovery from intrusions is typically a very time-consuming operation in current 
systems. At a time when the cost of human resources dominates the cost of 
computing resources, we argue that next generation systems should be built with 
automated intrusion ... 
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The papers in this two volume proceedings are presented at the 7th Annual Geneti 
and Evolutionary Computation Conference (GECCO-2005) , held in Washington, D.( 
June 25-29, 2005. This year is an exceptional one for the GECCO conference series 
First, ... 
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These proceedings contain the papers presented at the 9 th Annual Genetic and 
Evolutionary Computation Conference (GECCO-2007) , held in London, UK, July 7-1 1, 
2007. For the first time GECCO was held outside the US. This clearly proved ... 
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Analyzing intrusions today is an arduous, largely manual task because system 
administrators lack the information and tools needed to understand easily the 
sequence of steps that occurred in an attack. The goal of BackTracker is to identify 
automatically ... 
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